Privacy policy

Last updated: 28 October 2026.

This policy explains how BuscaPro processes personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD). It applies to visitors, account holders, customers who request quotes, owners who manage a company and the professionals and companies listed in the directory.

1. Data controller

• Controller: [COMPANY NAME — pending], owner of BuscaPro
• Address: [ADDRESS — pending], Slovakia
• Company ID (IČO): [IČO — pending]
• Privacy contact: [EMAIL — pending] or the site's contact form

[Data protection officer: whether one must be appointed is still to be decided.]

2. What data we process, why and on what legal basis

Companies and professionals in the directory

If your company or your work as a self-employed professional appears in the directory, we process data that may be personal, especially if you trade under your own name:

• Data: trade name or the professional's name, phone, address, website, public email, opening hours, services and service area.
• Source: company databases acquired from third parties, compiled from information that companies themselves publish online (for example, their listings on map services and their websites); OpenStreetMap; user suggestions reviewed by a moderator; and what the owner publishes when managing the profile.
• Purpose: publishing a directory that lets consumers find and contact professionals, and producing aggregate visit statistics for the company.
• Legal basis: the legitimate interest (Article 6(1)(f) GDPR) of BuscaPro and of consumers in finding services. We only publish business contact details that the company has already made public, and you can object at any time.
• Retention: while the profile is published. If you ask us to remove it, we keep only minimal data (phone, website domain and source identifier) so that it is not imported again.

Since we do not receive this data from you, this policy is the information required by Article 14 GDPR. We remind you of it when you claim the profile.

User account

• Data: email, password stored irreversibly (Argon2id hash), name used to sign reviews, language and technical data of sign-in sessions.
• Purpose: creating your account, letting you sign in and recover access.
• Legal basis: performance of the Terms of use you accept (Article 6(1)(b) GDPR).
• Retention: while you have the account. Session data is deleted 30 days after the session ends.

Managing a company

• Data: your account, the company's verified phone, documents you provide if verification is manual, the profile's change history and replies to reviews.
• Purpose: checking that you manage the company, preventing someone else from taking over the profile and letting you edit it.
• Legal basis: performance of the Terms of use; fraud prevention, as a legitimate interest.
• Retention: phone verification attempts, 90 days; everything else, while you manage the profile.

Paid plans

• Data: company name and tax or VAT number, billing address, email, subscribed plan, invoices and payment status. You enter card details on Stripe's page: BuscaPro neither sees nor stores them.
• Purpose: charging for the plan, issuing invoices and handling subscriptions, changes and cancellations.
• Legal basis: performance of the contract and compliance with accounting and tax obligations (Article 6(1)(b) and 6(1)(c) GDPR).
• Retention: for the duration of the subscription and then for the period required by accounting and tax law.

Quote requests

• Data: name, phone or email, description of the job and town.
• Purpose: delivering your request to the company you choose. The company sees it in its account; the email notice we send it does not include your data.
• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Recipient: only the company you choose, which becomes the controller of your data in order to reply to you.
• Retention: 12 months; then the data is anonymised.

Reviews

• Data: name used to sign, email, phone if you give it, rating, text, photos and «Helpful» votes.
• What is published: the signing name, date, rating, text and photos. Email and phone are not published. Photos are stored without EXIF metadata or location.
• Purpose: publishing reviews, moderating them and detecting fake reviews.
• Legal basis: performance of the Terms of use; moderation and fraud prevention, as a legitimate interest.
• Retention: while the review is published or you have the account. Reviews whose email is not confirmed are deleted after 30 days; photos of rejected reviews are deleted on rejection.

Contact, reports, company suggestions and removal requests

• Data: name, email, phone when it needs to be verified, the message and the IP address from which the request is sent.
• Purpose: replying to you and handling your request.
• Legal basis: legitimate interest in assisting you; for data protection requests, compliance with a legal obligation (Article 6(1)(c) GDPR).
• Retention: as long as needed to handle the request and to show that we have done so.

Security and abuse prevention

• Data: IP address, browser and time of sign-ins and form submissions.
• Purpose: limiting sign-in attempts and mass submissions, and protecting accounts. The contact form uses ALTCHA, a challenge solved by your browser without third-party services.
• Legal basis: legitimate interest in the security of the service (Article 6(1)(f) GDPR).
• Retention: 30 days.

Statistics

We count profile visits, clicks on «Show phone» and on the website, and requests, only as daily totals per profile. We do not store IP addresses or visitor identifiers in statistics and do not use cookies for them.

Emails

We send you the notices the service needs: email confirmation, access recovery, requests, moderation decisions and payments. Company owners also receive reminders about the Pro trial and offers for BuscaPro plans (Article 21.2 LSSI). You can unsubscribe from these offers with the link in each email; account notices will keep arriving.

3. Who we share data with

We do not sell personal data. We only share it with:

• The company you choose, when you request a quote from it.
• Site visitors, for public profile data and reviews.
• Providers that process data on our behalf (processors), under contracts that comply with Article 28 GDPR.
• Authorities and courts, when the law requires it.

Provider	Service	Where data is processed
Hetzner Online GmbH (Germany)	Servers and file storage	European Union
Stripe Payments Europe, Ltd. (Ireland)	Payments and invoicing	European Union and United States
Twilio Ireland Limited (Ireland)	Verification codes by SMS and call	European Union and United States
DeepL SE (Germany)	Machine translation of company descriptions	European Union
Anthropic (Claude)	Suggestions to moderators on reviews, photos, profile changes and suggested companies. It receives no emails or phone numbers.	United States
SendPulse	Email delivery	[to be confirmed]
OpenFreeMap	Maps: your browser downloads tiles from its servers, which receive your IP address	[to be confirmed]

Stripe processes some payment data as an independent controller, to prevent fraud and meet its legal obligations; its privacy policy is at stripe.com/privacy.

4. International transfers

Some providers may process data in the United States. In that case the transfer relies on the EU-U.S. Data Privacy Framework, where the provider has joined it, or on the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).

5. Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you, and we do not profile you. An artificial intelligence system (Claude, by Anthropic) suggests to moderators whether a review, photo, profile change or suggested company follows the rules; a person always makes the decision. The order of profiles in the directory follows the criteria published in the Terms of use.

6. Your rights

You can request access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw any consent you have given, by writing to [EMAIL — pending] or through the contact form. We may ask you to prove your identity. We reply within one month, which can be extended by two more months for complex requests.

• Your account: you can change your data and delete the account in «Settings».
• Your company in the directory: if you do not want it published, use «Remove my data». We aim to remove the profile within 24 hours (30 days at most) and prevent it from being imported again. We handle objections to processing (Article 21 GDPR) the same way.

If you believe we have not handled your rights properly, you can complain to a supervisory authority. As the controller is established in Slovakia, the lead authority is the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk); you can also contact the Spanish Data Protection Agency (aepd.es).

7. Minors

BuscaPro is intended for adults. You must be at least 18 to create an account, post reviews or request quotes. If we learn that we have received a minor's data, we delete it.

8. Security

We use encrypted connections (HTTPS), store passwords irreversibly, limit staff access to data and log access to personal data in the admin panel. The database is not reachable from the internet.

9. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant and you have an account, we will let you know by email.